Janik Wehrli

**Name of the Vulnerable Software and Affected Versions** Remote Utilities Host versions prior to 7.7.3.1 **Description** Insecure Access Control Lists (ACLs) are set on all DLL files within the installation directory `C:Program Files (x86)Remote Utilities - Host`, granting full control to the built-in Everyone group. A Windows service running as `NT AUTHORITYSYSTEM` loads DLLs from this location. While files are locked during runtime, a race window occurs when the service is stopped, such as during a crash or software update. This allows a local unprivileged attacker to replace a DLL with a malicious payload, which then executes with system privileges upon service restart. The DLL `libasset32.dll` was confirmed as actively loaded, and other affected files include `eventmsg.dll`, `libcodec32.dll`, `vp8encoder.dll`, `vp8decoder.dll`, `webmvorbisdecoder.dll`, `webmvorbisencoder.dll`, and `webmmux.dll`. **Recommendations** Update to a version newer than 7.7.3.0.

**Name of the Vulnerable Software and Affected Versions** servereye client versions prior to 20.16 **Description** The servereye client, also known as sensorhub or ClientAgentContainerService, contains a local privilege escalation flaw. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe) runs as SYSTEM and monitors the directory `%ProgramData%ServerEye3update` for a trigger file named `update available`. Because of insufficient access restrictions on this directory, a local standard user can create the trigger file and specify a path to a directory containing malicious JSON instructions. The service then executes the utility UpdaterAction.exe with SYSTEM privileges, which parses these instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination, such as overwriting a service binary. This allows for full system compromise when the service automatically restarts the overwritten binary with SYSTEM privileges. **Recommendations** Update the servereye client to a version newer than 20.15. Restrict write access to the `%ProgramData%ServerEye3update` directory to prevent unauthorized users from creating the `update available` trigger file.

**Name of the Vulnerable Software and Affected Versions** oretnom23 Pharmacy Point of Sale System version 1.0 **Description** An SQL Injection issue exists in the login function in actions.php. This allows for potential unauthorized access to sensitive data. **Recommendations** For oretnom23 Pharmacy Point of Sale System version 1.0, consider disabling the login function in actions.php until a patch is available. Restrict access to the actions.php file to minimize the risk of exploitation. Avoid using user input in the login function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.